Microsoft’s September patch release has set a new record, fixing roughly 972 vulnerabilities. Of those, 112 meet the high critical-severity threshold. The scale of the release stands out even against recent months: just two months ago, Microsoft patched a then-record 570 vulnerabilities, and last month it patched about 620.
Microsoft is not alone in reporting unusually large numbers. Google and other companies have also published record numbers of vulnerabilities in recent months.
Industry Warns of a Narrowing Patching Window
The surge in patches comes amid growing concern about how quickly attackers may be able to exploit flaws. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities. The letter pointed to an expected tsunami of AI-enabled attacks that actively exploit vulnerabilities first.
In response, the industry is taking the threat seriously by releasing unprecedented numbers of patches for its software.
A 'New Normal' for Vulnerability Numbers
Dustin Childs, a researcher at the Zero Day Initiative, calls the spikes the “new normal.” He also cautions that despite the higher volume of patches, the damage likely to result from AI-assisted attacks could eventually be substantial.
